EUVD-2026-100877
GHSA-9qvw-27hh-6rvg
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify WordPress site running Rank Math SEO
-
ExploitSend crafted unauthenticated HTTP request
-
ExecutionBypass missing capability/nonce check
-
ImpactClear stored SEO analysis data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | No special conditions beyond having the Rank Math SEO plugin installed and active at a version earlier than 1.0.280: the vulnerable code path that clears stored SEO analysis data performs no capability check and no nonce check, so any remote unauthenticated user can invoke it against default installations (AV:N/AC:L/PR:N/UI:N). The only meaningful limiting factors are (1) the target must be running an unpatched version (<1.0.280), and (2) the impact is bounded to deletion of the plugin's stored SEO analysis data - there is no confidentiality exposure and no broader site availability impact, so the realistic damage is limited to loss of that analysis data. |
| Impact | This is a genuinely low-to-moderate priority issue despite the medium CVSS of 5.3, and the signals are internally consistent rather than conflicting. The CVSS vector (AV:N/AC:L/PR:N/UI:N) correctly reflects that a remote, unauthenticated attacker can trigger the flaw with no user interaction and low complexity, which is why it is network-scored - but the impact is deliberately narrow: C:N/I:L/A:N means only a low integrity hit (deletion of stored SEO analysis data) with no confidentiality exposure and no availability/takedown of the site. The EPSS probability is very low (0.17%, 5th percentile) and the SSVC decision framework rates Exploitation as 'none' (no observed active exploitation) even though it marks the issue Automatable=yes and Technical Impact=partial. It is NOT in CISA KEV. A public exploit is available (WPScan), so the Automatable=yes rating is credible, but the combination of low EPSS, no KEV listing, and only partial/low technical impact means this is best characterized as a nuisance data-integrity bug rather than a server-compromise priority. The realistic worst case is loss or deletion of SEO analysis data, not code execution or data theft. Treat as routine patch-cycle severity, prioritized above cosmetic bugs because it is unauthenticated and scriptable, but well below RCE or data-exfiltration flaws. |
| Exploit ScenarioDerived | An attacker, without any account or authentication, sends a crafted HTTP request directly to the vulnerable Rank Math SEO endpoint that clears stored SEO analysis data, bypassing the missing capability and nonce checks. Because publicly available exploit code exists and the action is automatable, an attacker can script this against many WordPress sites to repeatedly wipe their accumulated SEO analysis results. No user interaction or prior access is required. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 14, 2026
Unauthenticated remote attackers can delete the stored SEO analysis data held by the Rank Math SEO WordPress plugin in any version before 1.0.280, because the routine that wipes that data enforces neither a capability check nor a nonce. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, C:N/I:L/A:N, 5.3) reflects an unauthenticated, network-reachable integrity-only impact: confidentiality and availability are untouched, so the realistic damage ceiling is loss of the plugin's cached SEO analysis results rather than site compromise or downtime. Publicly available exploit code exists and the vendor has shipped a fix, but CISA's SSVC evaluation rates exploitation as "none" and EPSS is only 0.17% (5th percentile), so this is a low-to-moderate priority issue and not confirmed actively exploited (no CISA KEV listing).
RemediationAI
Upgrade Rank Math SEO to version 1.0.280 or later, which is the vendor-released patch that adds the missing capability and nonce checks before the SEO analysis data can be cleared; the vendor advisory and technical write-up is at https://wpscan.com/vulnerability/b68d607d-aad8-46ad-a522-5eaeea738d8c/, with the CVE cross-reference at https://nvd.nist.gov/vuln/detail/CVE-2026-104751 and EUVD-2026-100877 for tracking. For sites that cannot immediately update, the most effective compensating control is to deactivate the Rank Math SEO plugin until the upgrade can be applied - this removes the vulnerable code path entirely at the cost of losing the plugin's SEO tooling and its front-end output; note that WordPress.org-hosted plugins can usually be patched in place via the dashboard or WP-CLI with minimal downtime, so deactivation should be a stopgap rather than the plan. Restricting access to the plugin's admin-ajax/REST endpoints with a web application firewall or reverse-proxy rule that blocks unauthenticated requests to the analysis-clearing action would reduce exposure, but such rules require identifying the exact route and are prone to breaking legitimate AJAX behavior, and they only defend traffic that actually traverses the filtering layer. There is no configuration setting inside the plugin that turns this off, and no credential-based mitigation exists because the flaw is precisely the absence of any credential requirement, so patching to 1.0.280+ remains the only complete fix.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected component is the Rank Math SEO plugin for WordPress, identified in CPE as cpe:2.3:a:unknown:rank_math_seo:*:*:*:*:*:*:*:* and reported by WPScan, which tracks WordPress plugin vulnerabilities. The root cause is CWE-862 (Missing Authorization): the code path that clears the plugin's stored SEO analysis data is exposed without any capability check (e.g. current_user_can) and without a nonce/CSRF token validation, so WordPress performs no permission gate before executing the deletion. Under the WordPress request model this means the endpoint is reachable by anyone who can make an HTTP request to the site - no session, no cookie, and no valid nonce are required. Because the flaw is a pure authorization gap rather than injection or memory corruption, the consequences are limited to state modification of plugin-owned data: the SEO analysis records are removed. The unauthenticated, no-user-interaction profile (PR:N/UI:N) explains why SSVC flags the issue as "Automatable: yes" with "Technical Impact: partial" - it can be triggered at scale by a script, but the resulting impact is confined to data deletion, with no confidentiality loss and no broader availability effect. No authentication requirements beyond that are inferred from the description alone; the PR:N rating comes directly from the supplied CVSS vector and the independent assessment.
Know when Rank Math Seo gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Unauthenticated remote request with no interaction (AV:N/AC:L/PR:N/UI:N); only unauthorized deletion of stored data gives I:L, with no confidentiality or availability impact.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
4DescriptionCVE.org
The Rank Math SEO WordPress plugin before 1.0.280 does not perform a capability or nonce check before clearing its stored SEO analysis data, allowing unauthenticated users to delete it.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
More in Rank Math Seo
View allRank Math SEO WordPress plugin versions before 1.0.277.1 exposes the full content of password-protected posts to unauthe
Rank Math SEO WordPress plugin before version 1.0.277 allows authenticated users holding at minimum an Author role to ov
Rank Math SEO WordPress plugin versions prior to 1.0.277 allows users holding the Editor role to modify site-wide admini
Unauthenticated schema disclosure in the Rank Math SEO WordPress plugin (versions 1.0.48 through 1.0.276) allows any ano
Remote code execution in the Rank Math SEO WordPress plugin (versions <= 1.0.276) is reachable by any user holding WordP
Unauthenticated Cross-Site Scripting in the Rank Math SEO WordPress plugin (versions up to and including 1.0.274.1) allo
Rank Math SEO WordPress plugin before version 1.0.277 allows any authenticated user with at least the Author role to mod
Privilege escalation in the Rank Math SEO WordPress plugin (versions before 1.0.277) lets any authenticated Author-role
Insecure direct object reference (IDOR) in Rank Math SEO WordPress plugin before 1.0.277 allows authenticated users with
Broken access control in the Rank Math SEO WordPress plugin (versions ≤ 1.0.271) allows authenticated subscribers to inv
Exploit-DB